loading...

Discussion on: Please Stop Using Local Storage

ivankleshnin profile image
Ivan Kleshnin

If you fetch from the browser, you don't get cookies. You have to add {credentials: "include"}. And that requires a whitelisting on the server. So no, it's no so easy to get httpOnly cookie content in browser as you describe. It requires a TRACE method or other known vulnerability or bug to expose them. Pls. prove me wrong if you think otherwise.

Other than that, I agree with your point. When an app has an XSS injection there are tons of attack vectors a hacker can take. And yes, localStorage is almost the same as cookies security-wise. This article is mostly a FUD, unfortunately.

Thread Thread
maciek134 profile image
Maciej Sopyło

His point was that you don't need to read the cookie if you can send requests when the user is on the compromised website.